1163484 matches found
CVE-2026-15217
creationtimestamp| type| source ---|---|--- 2026-08-13 10:21:54+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-20 2026-08-13 14:05:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msxssijrld2m 2026-08-13 20:15:15+00:00| seen|...
DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms
A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...
dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution
A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting XSS, occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like script or iframe. An attacker can craft malicious input that, during...
DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization.
A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting XSS by exploiting a state leakage issue. Specifically, function predicates used for adding attributes or tags during sanitization can persist across multiple calls to the sanitize function...
CVE-2026-3639
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by etomixer in WordPress Plugin Mang Board WP versions = 2.3.4...
CVE-2026-3639
CVE-2026-3639 : The PPWP – Password Protect Pages plugin for WordPress is vulnerable toStored Cross-Site Scripting via the plugin’s ppwp shortcode attributes in all versions up to and including 1.9.21, due to insufficient input sanitization and output escaping on user-supplied attributes. Authent...
WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Do Lasso versions = 358...
WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme theme <= 2.5 - Cross Site Scripting (XSS) vulnerability
WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme theme = 2.5 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Samex - Clean, Minimal Shop WooCommerce WordPress Theme versions = 2.5...
PT-2026-71684
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...
PT-2026-71549
Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
PT-2026-71591
Unauthenticated Cross Site Scripting XSS in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-19744: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...
CVE-2026-73357: Improper Neutralization of Input During Web Page Generation
Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...
CVE-2026-73340: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...
CVE-2026-66698: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in SureDash = 1.10.1 versions...
CVE-2026-66697: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-61960: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...